Chromium Code Reviews
chromiumcodereview-hr@appspot.gserviceaccount.com (chromiumcodereview-hr) | Please choose your nickname with Settings | Help | Chromium Project | Gerrit Changes | Sign out
(438)

Unified Diff: Source/web/tests/WebFrameTest.cpp

Issue 1177333002: Revert of Detach old frame on WebFrame::swap. (Closed) Base URL: https://chromium.googlesource.com/chromium/blink.git@master
Patch Set: Created 5 years, 6 months ago
Use n/p to move between diff chunks; N/P to move between comments. Draft comments are only viewable by you.
Jump to:
View side-by-side diff with in-line comments
Download patch
« no previous file with comments | « Source/web/tests/FrameTestHelpers.cpp ('k') | public/web/WebFrameClient.h » ('j') | no next file with comments »
Expand Comments ('e') | Collapse Comments ('c') | Show Comments Hide Comments ('s')
Index: Source/web/tests/WebFrameTest.cpp
diff --git a/Source/web/tests/WebFrameTest.cpp b/Source/web/tests/WebFrameTest.cpp
index 78b5ad1c698758e3255416471df7031a9e5dc046..a8c8b22ba93b3a724f0bee68b1e325ceed65fb62 100644
--- a/Source/web/tests/WebFrameTest.cpp
+++ b/Source/web/tests/WebFrameTest.cpp
@@ -7022,6 +7022,19 @@
WebRemoteFrame* remoteFrame = remoteClient.frame();
WebFrame* targetFrame = mainFrame()->firstChild()->nextSibling();
targetFrame->swap(remoteFrame);
+ // FIXME: This cleanup should be unnecessary, but the interaction between frame detach
+ // and swap is completely broken atm. swap() calls detachChildren() on the frame being
+ // swapped out, and frame B has a child. When the child of B is detached, it schedules a
+ // FrameLoader timer to check for load completion in its parent.
+ // Other tests end up spinning the message loop (e.g. to wait for load completion of
+ // another test page, so this timer callback is processed before FrameHost and Page are
+ // destroyed by the reset() at the end of the test case. However, this test does not spin
+ // the event loop in its body, so the timer task remains in the queue and ends up running
+ // in the setup for the following test. Since the FrameHost/Page for the associated
+ // FrameLoader have already been destroyed, this leads to crashes/use-after-frees. To
+ // prevent that, manually call detach() on the Frame to release its resources and cancel
+ // pending callbacks.
+ toCoreFrame(targetFrame)->detach();
remoteFrame->setReplicatedOrigin(SecurityOrigin::createUnique());
v8::Local<v8::Value> remoteWindow = mainFrame()->executeScriptAndReturnValue(WebScriptSource(
"document.querySelector('#frame2').contentWindow;"));
@@ -7046,6 +7059,7 @@
// Manually reset to break WebViewHelper's dependency on the stack allocated
// TestWebFrameClient.
reset();
+ remoteFrame->close();
}
TEST_F(WebFrameSwapTest, SwapInitializesGlobal)
« no previous file with comments | « Source/web/tests/FrameTestHelpers.cpp ('k') | public/web/WebFrameClient.h » ('j') | no next file with comments »

Powered by Google App Engine
This is Rietveld 408576698